"Security" matching MCP servers:

MCP server for scanning smart contracts for security vulnerabilities. It detects issues like reentrancy, overflow, access control, and provides security scores with NEAR-specific recommendations.

Enables scanning OpenAPI specifications for security gaps and generating security test checklists for APIs.

Enables LLMs to make HTTP requests with OAuth2, session cookies, retry logic, and cURL command generation, while providing security features like SSRF protection and TLS enforcement.

Security intelligence API for AI models. CVE lookup with EPSS/KEV, domain recon (DNS, WHOIS, SSL, subdomains, WAF), and code security checks (secrets, injection, headers). 16 tools, no API key required.

Enables AI assistants to interact with Fastly's CDN API through the Model Context Protocol, allowing secure management of CDN services, caching, security settings, and performance monitoring without exposing API keys.

Enables local analysis of OpenAPI 3 and Swagger 2 JSON/YAML spec files on disk, with no remote fetching of specs or credentials. It groups endpoints by tag, flags operations that appear to lack security, lists deprecated operations, and produces short markdown cheat sheets for agents.

Enables LLMs to dereference and query OpenAPI/Swagger specifications, search endpoints and schemas, validate payloads, extract security schemes, and generate production-ready integration code in multiple languages.

A comprehensive suite of HTTP and API testing tools that enables AI agents to perform requests, check endpoint health, and decode JWTs. It also provides utilities for URL parsing and detailed security analysis of HTTP response headers.

MCP server for API test case generation from Swagger/OpenAPI specs. Parses Swagger 2.0 and OpenAPI 3.x, generates test cases across 8 categories (positive, negative, boundary, auth, security, idempotency, pagination, business logic), and exports to Postman, TestRail, Allure, k6, pytest, Gherkin, and CSV. Supports internal corporate APIs with auth headers. Auto-saves export files to your working di

AI-native HTTP security testing MCP server — 18 tools with raw HTTP/1.1 + HTTP/2 control

Exposes Burp Suite's REST API to AI assistants, enabling users to trigger vulnerability scans, monitor progress, and manage security tasks through natural language. It also provides programmatic access to Burp's security knowledge base for querying vulnerability definitions and remediation advice.

MCP server providing diagnostic tools to analyze software architecture, security, REST API compliance, and dependencies for multiple programming languages. Enables AI agents to run scans and audits on codebases.

A sovereign, universal API validation and multi-industry compliance security MCP server.

A comprehensive HTTP client MCP server for security testing, API testing, and web automation that provides full-featured HTTP tools with detailed logging capabilities.

Enables management of penetration testing reports and vulnerabilities through a REST API, supporting CVSS 3.1 scoring, HTML formatting, and secure JWT authentication for comprehensive security assessment documentation.

Enables AI agents to explore any OpenAPI 3 spec, inspect endpoints and schemas, generate TypeScript types, and make authenticated API calls using credentials mapped to the spec's security schemes.

An MCP server for checking OWASP Top 10 vulnerabilities during API development testing. It analyzes API information and returns security assessment results to help developers identify potential security issues.

Enables AI coding agents to list, inspect, triage, and bulk-update security findings and issue groups from Sourcery's public security API, with aggregate counts, cursor pagination, and generated minimal-change fix prompts. It exposes 12 tools wired to a pinned OpenAPI snapshot, running over stdio or Streamable HTTP.

Enables AI assistants to perform automated security audits on APIs, detecting BOLA/IDOR vulnerabilities by comparing responses across user tokens.

A Model Context Protocol server designed for testing backend APIs for security vulnerabilities like authentication bypass, injection attacks, and data leakage.

DreamFactory MCP Server enables AI assistants like Claude to directly query your databases through DreamFactory's auto-generated REST APIs. This Node.js server implements the Model Context Protocol (MCP), allowing natural language database interactions while maintaining enterprise-grade security.

Gorgon Scout is a Windows web-application and API security scanner (DAST). This connector exposes it as MCP tools, so your AI assistant can record a target you are authorised to test, run the scan, stream findings, and produce a report. Capture needs no proxy or certificate setup, and it intercepts HTTP/1.1, HTTP/2, and HTTP/3 (QUIC). Works with the free Claude Desktop plan.

Enables active, authorized security testing of remote MCP servers' OAuth authorization flows, reporting results as JSON, SARIF, and Markdown. It runs checks for refresh token rotation, redirect URI strictness, PKCE enforcement, token audience, throttling, and consent CSRF.

MCP Portico is an MCP server that turns OpenAPI descriptions or inspected backend source code into policy-controlled MCP connections, exposing multiple backend systems with tenant isolation and credential security.

Enables AI agents to perform API testing and security validation through a permission-gated, SSRF-protected, audited MCP tool layer.

Converts SOAP WSDL services into a REST interface and provides MCP tools to describe, invoke, and manage SOAP operations with caching and WS-Security support.

Enables agents to run deterministic security reviews of OpenAPI and Swagger documents, including scanning specs, listing and explaining OWASP-mapped rules, checking authentication coverage, and generating sample audits.

Audits any MCP server (stdio or Streamable HTTP, legacy or modern era) with wire-level conformance, security, and behavior-regression checks, producing a fingerprinted delivery report and CI regression suite.

Scan APIs for security vulnerabilities and get OWASP risk scores. Detects auth bypass, BOLA/IDOR, data exposure, prompt injection, and 12+ security categories.

MCP server that exposes Strapi v5 content management, visual layout configuration, schema authoring, media uploads, and GraphQL testing to LLM clients via native Strapi API tokens with security hardening.